nir: prevent use-after-free condition in should_lower_phi()
authorEduardo Lima Mitev <elima@igalia.com>
Tue, 2 Jun 2015 11:42:46 +0000 (13:42 +0200)
committerEduardo Lima Mitev <elima@igalia.com>
Tue, 2 Jun 2015 18:21:49 +0000 (20:21 +0200)
commit5b226a12420993a0f4aae2295b33aaa305242a3d
treea5e27f298b6a4b02b9332ec0734c1c0ae62a892b
parent762395736be3adcc810274e1e96acd4bdceb10c6
nir: prevent use-after-free condition in should_lower_phi()

lower_phis_to_scalar() pass recurses the instruction dependence graph to
determine if all the sources of a given instruction are scalarizable.
To prevent cycles, it temporary marks the phi instruction before recursing in,
then updates the entry with the resulting value. However, it does not consider
that the entry value may have changed after a recursion pass, hence causing
a use-after-free situation and a crash.

This patch fixes this by reloading the entry corresponding to the 'phi'
after recursing and before updating its value.

The crash can be reproduced ~20% of times with the dEQP test:

dEQP-GLES3.functional.shaders.loops.while_constant_iterations.nested_sequence_fragment

Reviewed-by: Jason Ekstrand <jason.ekstrand@intel.com>
src/glsl/nir/nir_lower_phis_to_scalar.c